As a personal data subject, what are your rights?
Request from the Controller access to the personal data, i.e. you have the right to obtain from the Controller a confirmation as to whether or not your personal data are being processed, and, where this is the case, you have the right to access them together with the following information:
- The purposes of processing;
- The categories of personal data concerned;
- The recipients or categories of recipient to whom the personal data have been or will be disclosed;
- The envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- The existence of the right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data or to object to such processing;
- The right to lodge a complaint with a supervisory authority;
- All available information about the sources of personal data;
- The existence of automated decision-making, including profiling, about the procedure used, as well as the significance and the envisaged consequences of such processing for me;
- The right to be informed about appropriate safeguards that relate to the transfer of personal data to third countries (i.e. outside the European Union), in the event the personal data are transferred over to such third country;
- The Controller shall provide you with a copy of the personal data undergoing processing.
Request the rectification of personal data, i.e. to have the Controller, without undue delay, rectify inaccurate personal data concerning you, and taking into account the purpose of the processing, you also have the right to have incomplete personal data completed, including by means of providing a supplementary statement;
Request the erasure of personal data (“right to be forgotten”), i.e. to obtain from the Controller the erasure of personal data concerning you without undue delay, where one of the following grounds applies:
- The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- You withdrew consent on which the processing is based and there is no other legal ground for the processing;
- The personal data have been processed unlawfully;
- The personal data have to be erased for compliance with a legal obligation;
- The personal data have been collected in relation to the offer of information society services;
- The right to erasure does not apply if there is an exception, in particular because processing of personal data is necessary for:
- Exercising the right of freedom of expression and information;
- Compliance with a legal obligation which requires processing by Union or Member State law to which the Controller is subject;
- For the establishment, exercise or defence of legal claims;
Request restriction of processing of personal data, i.e. the right for the Controller to restrict the processing of personal data in any of the following cases:
- You contest the accuracy of the personal data processed, processing will be restricted for a period enabling the Controller to verify the accuracy of the personal data;
- The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
- The Controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
- You objected to processing of personal data in the event the personal data are processed for the purpose of legitimate interests of the Controller, including profiling, in such case the Controller will no longer process the personal data, unless legitimate reasons for processing are proved that dominate over the interests or rights and freedoms of the personal data subject, or the establishment, exercise or defence of legal claims;
Where processing has been restricted personal data shall, with the exception of their storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State;
Personal data portability, i.e. the right to have the Controller transfer your personal data processed automatically based on your consent to another Controller in a structured, commonly used and machine-readable format; when exercising your right to data portability you have the right to have the personal data transmitted directly from one controller to another, where technically feasible;
The right to object; in the event your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing, and in such case the personal data will no longer be used for such purposes.
File a complaint, for example by sending an e-mail or letter to the Controller’s contact details specified above; a complaint about the Controller’s actions can be made to the Office for Personal Data Protection, registered office: Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.
You can apply all of the above mentioned rights to the Administrator by sending an e-mail to the addresses given in the introductory part of this information or by letter.